To get ISO 42001 certified you have to meet its requirements — but the standard's language can be dense. This guide translates what ISO/IEC 42001 actually asks for: the management-system clauses and the Annex A controls, in plain English. It's part of our guide to ISO 42001 certification.
ISO 42001 uses the same harmonised high-level structure as ISO 27001 and ISO 9001, so its requirements sit in clauses 4 to 10. Clauses 1–3 cover scope, references and terms; the auditable requirements begin at clause 4.
Alongside the clauses, Annex A provides a reference set of AI-specific controls you select and implement based on your risks. They span areas such as AI policies; internal organisation and roles; resources for AI systems (data, tooling, human oversight); AI impact assessment; the AI system lifecycle from design to retirement; data management and quality; information and transparency for users; and the responsible use and third-party or supplier management of AI. You record which controls apply, and why, in a Statement of Applicability.
A defining requirement of ISO 42001 is the AI system impact assessment — evaluating the consequences of an AI system on individuals and groups, not just on the organisation. This, alongside the risk assessment, is where most of the real work sits, and where auditors look closely.
Meeting these requirements is exactly what a certification audit checks — Stage 1 reviews your documentation and readiness, Stage 2 tests that the system operates in practice. See how to get ISO 42001 certified and work through the ISO 42001 checklist.
AramGRC's ISO/IEC 42001 gap assessment scores your organisation against every clause and Annex A control and hands you a prioritised roadmap to close the gaps.
ISO 42001's requirements sit in clauses 4–10 (context, leadership, planning, support, operation, performance evaluation, improvement), plus a set of AI-specific controls in Annex A that you select based on your risks.
Annex A is the standard's reference catalogue of AI-specific controls — covering AI policy, roles, impact assessment, the AI lifecycle, data, transparency and third-party AI — that you apply and record in a Statement of Applicability.
An assessment of how an AI system affects individuals and groups. It's a defining ISO 42001 requirement and a key focus of certification audits.
Annex A provides a catalogue of AI-specific controls grouped into control areas; you apply the ones relevant to your risks and document them in a Statement of Applicability, rather than implementing all of them regardless.
Start here — what ISO 42001 is, what it requires, costs, and how to get certified.
The world's first certifiable AI management system standard — requirements, Annex A controls, certification, cost, training and India relevance.
The standard explained in plain language.
The clauses and Annex A controls ISO 42001 asks for.
You're here
The 38 AI controls across 9 objectives (A.2–A.10), and how you select which apply.
What ISO 42001 certification costs, including in India.
A step-by-step readiness checklist for certification.
The mandatory policies, procedures and records — and what a good ISO 42001 toolkit includes.
How the AI and information-security standards differ.
The certification process, step by step.
Courses and credentials for individuals.
The role that builds and runs the AIMS — course, exam and how it differs from Lead Auditor.
DPDP Act, MeitY guidelines and RBI FREE-AI, mapped to one AIMS.
A standard, a voluntary framework and a law — how they fit together.
How smaller AI companies scope, cost and pursue certification proportionately.
Who is certifying, why the list is growing, and how to verify a certificate.